Authly stores your TOTP secrets in the cloud, but it cannot read them. Here is how that works.
Two keys
Your master password is stretched with PBKDF2 into a key-encryption key. That key never leaves your browser. It wraps a randomly generated data-encryption key, and that data key encrypts every secret with AES-GCM.
What the server sees
Only ciphertext, an initialization vector, and the wrapped key. Without your master password none of it can be decrypted — which is exactly why recovery kits and backups matter.